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Abstract 


A multilayer approach to the prevention of conflicts due to the loss of aircraft-to-aircraft 
separation which relies on procedures and on-hoard automation was implemented as part of 
the SATS HVO Concept of Operations. The multilayer system gives pilots support and 
guidance during the execution of normal operations and advance warning for procedure 
deviations or off-nominal operations. This paper describes the major concept elements of 
this multilayer approach to separation assurance and conflict prevention and provides the 
rationale for its design. All the algorithms and functionality descrihed in this paper have 
heen implemented in an aircraft simulation in the NASA Langley Research Center’s Air 
Traffic Operation Lah and on the NASA Cirrus SR22 research aircraft. 
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I. Introduction 

T he Small Aircraft Transportation (SATS) Higher Volume Operations (HVO) concept was developed to 
increase access to thousands of public use airports in the United States by increasing the rate of operations at 
these facilities without a major impact on the air traffic controller’s workload or on overall National Airspace 
System (NAS) structures and principles. HVO procedures were designed for use at non-radar, non-towered airports 
in near all-weather conditions within a volume of airspace where pilots have the responsibility for maintaining safe 
separation from other traffic. 

The notion of conflict prevention was established as a design goal of the SATS HVO concept. The conflict 
prevention foundation that researchers used to develop the HVO concept means that by design, pilots should always 
have a safe place to be in the Self-Controlled Area (SCA). Should an HVO pilot stray beyond the constraints of the 
HVO procedure, then advisories and alerting would increase appropriately in intensity and frequency to cue the pilot 
to return into conformance with the procedure. Previous uses of the tenn “conflict prevention” include a technique 
that alerted pilots of potential short-term conflicts as a result of turns and vertical maneuvers in the en-route phase of 
flight [18]. A multilayer approach to separation assurance and the prevention of conflicts due to the loss of aircraft- 
to-aircraft separation is an explicit part of the SATS HVO Concept of Operations design that uses both procedures 
and onboard automation. The multilayer system gives pilots support and guidance during the execution of normal 
operations and advance warning in case of procedure deviations or off-nominal operations. 


II. SATS HVO Concept Overview 

At towered airports, air traffic controllers (ATC) provide sequencing and separation for all Instrument Flight 
Rules (IFR) and participating Visual Flight Rules (VFR) aircraft. They control aircraft on the runway and in the 
controlled airspace iimnediately surrounding the airport. They coordinate the sequencing of aircraft in the traffic 
pattern and direct aircraft on how to safely land and depart at and from the airport. Conversely, at airports without 
control towers and radar coverage, IFR flights are limited to one operation at a time during instrument 
meteorological conditions. SATS HVO procedures rely on the establishment of a volume of airspace around 
designated airports referred to as a SCA where air traffic management functions are distributed between pilots and a 
ground based automated system called the 
Airport Management Module (AMM). 

Within the SCA, pilots are expected to fly 
according to SATS-HVO operational 
procedures and to accept responsibility for 
separation. 

The AMM provides landing sequence 
infonnation to approaching aircraft via 
datalink on a first-come first-serve basis. 

The AMM acts as a ground based arbiter 
that centralizes the decision making function 
of “who goes first” without trying to make 
efficiency based inferences or give pilots 
instructions or clearances. This division of 
responsibilities between the cockpit 
(airborne separation) and the AMM (ground based sequencing) is fundamental to this concept since it enables the 
development of automated tools for these two functions: a distributed airborne separation function and a centralized 
sequence arbitration function. The AMM only retains the function that by its nature requires complete knowledge of 
the entire system and would therefore be very difficult to implement as a distributed entity (i.e., sequencing function 
placed in the cockpit). The rationale for this concept as well as a more in depth description of the functional 
structure of the National Airspace System (NAS) can be found in [5]. Prior applications include the method for 
separation assurance described in [1], where a concept of operations is presented that includes a similar division of 
air traffic management functions. 

Aircraft separation in the SCA is based primarily on pilot procedures and supporting procedure automation in the 
cockpit. Minimum aircraft equipage includes Automatic Dependent Surveillance - Broadcast (ADS-B), air-ground 
datalink communication, GPS based navigation and a Cockpit Display of Traffic Information (CDTI). 

Fig. I shows a diagram of a generic SCA and a SATS HVO approach path based on a GPS “T” approach 
consisting of two Initial Approach Fixes (lAF), AZBEJ and UHYES, an Intermediate FIX UCGEL and a Final 
Approach Fix MELFA. Two holding altitudes at 2000 and 3000 feet at each of the lAFs are part of the SCA. 
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Flights whose destination is a SATS airport must file an IFR plan indicating one of the lAFs as a fix in the route. 
Pilots must request ATC permission to transition from controlled airspace into the SCA after receiving an entry 
message from the AMM [4]. The AMM message includes the type of entry into the SCA, missed approach holding 
fix assignment and lead aircraft identification. Pilots must identify their lead aircraft on the CDTI and maintain 
proper spacing from it throughout the operation. 

The SATS FFVO concept relies on pilots complying with procedures, communicating their intentions and 
maintaining some degree of synchrony during operations. While minor deviations from these rules may have no 
negative effects, major procedure violations can be significant. A detailed description of the SATS HVO concept is 
out of the scope of this paper, but can be found in [2, 3 and 6]. 

III. Self-Separation in the SCA 

Self-separation in the SCA relies on a multi-tier approach that includes three logically independent layers: 
procedural separation. Procedure Support (PS) automation and Conflict Detection and Alerting (CDA). A key 
element in the SATS HVO separation assurance concept is the logical independence of the three layers that prevents 
a failure at one level from affecting a lower level. This important design property must be preserved during 
implementation to maintain the safety of the system. 

A. First Layer: HVO Procedures 

The SATS HVO procedures represent the first layer of separation assurance. They were designed to be both 
simple and robust and have been formally proven to provide safe separation to approaching and departing aircraft 
[11, 12]. The formal verification process guarantees that if all participating pilots in the SCA comply with 
procedures, no loss of separation conflicts can occur. Pilot procedures were also validated in human-in-the-loop 
experiments and flight test, where it was shown that pilots were able to perform them proficiently and with no 
increased workload as compared to today’s procedures [7, 8, 10, and 17]. Pilots reported increased situational 
awareness and no loss of separation conditions were observed. Key elements of the pilot procedures are: adhering to 
AMM provided sequence, maintaining IFR separation standards (3nm lateral and 1000 ft vertical) while using traffic 
depiction on a moving map display, and conforming to the instrument procedure. 

Because the SATS HVO procedures are based on published instrument approach and departure procedures, the 
pilot must have on-board IFR navigation systems that provide primary flight guidance. Should the pilot deviate 
from the HVO procedure, the on-board primary flight guidance system would show that deviation and the pilot’s 
role is to correct that error to return to conformance to the procedure. In order to be certified to fly IFR procedures, 
pilots must demonstrate proficiency in flying procedures to instrument-rating practical test standards criteria. 

In order for pilots to violate the first layer of separation assurance, they must violate sequence, or spacing, or 
exceed the level of acceptable navigation guidance deviations. 

B. Second Layer: Procedures Support Automation 

The second layer in the separation 
assurance concept is provided by the 
Procedure Support (PS) automation, which 
includes a set of tools that provide pilot 
advisories, based on the traffic conditions 
and AMM entry information. 

PS functionality provides help and 
guidance specifically related to the 
immediate task required by the operation. 

These advisories aid pilots during normal 
operating conditions, advise them in cases of 
minor deviations and non-nonnal conditions. 

The PS functionality is comprised of 
onboard confonnance monitoring, approach 
spacing and altitude determination tools. The 
conformance monitoring tool advises pilots 
of altitude, speed and path deviations during 

all holding patterns, approach segments, and Figure 2: Functional Diagram of the Pilot Support Automation 
missed approach segments. The spacing tool 

provides in-trail spacing advisories and approach initiation time. The altitude determination tool identifies open 
holding altitudes at the lAFs (or MAHF). 
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The procedure support advisories are part of an experimental pilot notification tool called the Pilot Advisor (PA) 
that uses dynamic messages shown on the Multi-Function Display (MFD). A functional diagram of the PS logic is 
depicted in Fig. 2. 


1. Conformance Monitoring Tool 

The conformance monitoring function checks if the aircraft satisfies all the conditions for the current phase of 
the procedure: lateral path, altitude and speed profile deviations are monitored during holding patterns, approach 
segment and missed approach segment. Pilots can perform small corrective maneuvers to fix deviations from flight 
path as soon as they are notified by the confoiTnance tool, even before these deviations are predicted to cause traffic 
conflicts. The conformance status is also broadcast to all participating aircraft via an on-condition ADS-B message. 
The PA issues pilot notifications indicating confonnance deviations based on the output from the conformance 
monitoring function. A subset of conformance monitoring messages displayed by the PA is shown in blue in Fig. 3. 

The design of the conformance monitoring tool used the concept of a Nominal Approach Path (NAP). The NAP 
is comprised of a containment volume around the approach path and a set of conditions. An aircraft is in 
conformance to its NAP if the following conditions are satisfied: 

• Aircraft remains within the lateral and vertical boundaries of the approach Containment Volume (CV). 
The CV is defined by a lateral and vertical error that limits the accepted deviation of an aircraft from its 
nominal trajectory. A CV is defined for all segments of the approach and holding patterns. During a 
missed approach, pilots must remain outside of the approach segments’ CV. 

• Aircraft enters the SCA according to the information received in the AMM entry notification. 

• Aircraft remains within intended speed profile during all the approach segments. 

• Aircraft performs a missed approach according to procedures, returning to the assigned Missed 
Approach Holding Fix (MAHF). 


2. Altitude Determination Tool 

According to the SATS HVO approach procedure, aircraft 
entering the SCA or flying a missed approach procedure must 
proceed to the lowest available altitude at the requested/assigned 
lAF/MAHF. The Altitude Determination tool verifies traffic 
conditions and notifies pilots of the available altitudes. Fig. 3 
shows two messages (“open 2000” and “open 3000”) indicating 
that no traffic is occupying the given altitudes. This function was 
proven to increase pilot’s situation awareness and reduce workload 
as shown in [9]. 


OPEN 3000 


TOO FAST 
CHECK SPEED 



OPEN 2000 


Monitor Path 

TTA: 2:45 




TOO SLOW 

OPEN APPROACH 


PROCEED NOW 

Figure 3: Examples of Pilot Advisor 


Conformance Monitoring Messages 


3. Spacing Tool 

The Spacing tool provides an approach initiation time for aircraft entering the SCA based on the position of the 
leading aircraft and the speeds and type of aircraft involved. The tool includes two main functions: a planning 
function and a real-time spacing error function. The planning function computes the delay time for the trailing 
aircraft required to maintain a minimum distance between itself and the leading aircraft on approach. The trailing 
aircraft must remain in holding until the indicated delay has elapsed. The real-time function is a state-based tool that 
computes the nominal distance and time errors associated with the two aircraft positions relative to their planned 
trajectories. Its output is used to provide appropriate pilot advisories indicating potential spacing violations. The 
spacing function logic is based on the notion of “active spacing” developed in [15] for precision approaches. Each of 
the two aircraft may use independent approach profiles with the constraint that the final approach segment points 
must be the same. Dissimilar approach speeds are allowed. Fig. 3 shows two PA massages based on the Spacing 
tool: “TTA: 2:25” advises the pilot to initiate the approach in 2 minutes and 25 seconds, at which time the message 
“open approach” will would be shown. 


4. The Pilot Advisor (PA) 

The pilot advisor function prioritizes advisory messages from the various support tools. Input to the procedure 
support function includes traffic and ownship position vectors, ownship flight plan, AMM sequence information and 
the SCA traffic state. The pilot advisor selects the appropriate advisory message to be shown to the pilot from the 
procedure support function based on the current phase of flight. This PA window is displayed when there are active 


The CV envelopes navigation deviation error, so a pilot deviating to the edge of the CV is already aware of this 
condition due to information from the on-board navigation system. 
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pilot advisory messages. A complete description of the PA functionality can be found in [9, 16]. The procedure 
support function and the PA represent a second layer of safety in the SATS HVO concept helping pilots to perform 
normal procedures and providing advisories to correct minor deviations. 

C. Third Layer: Conflict Detection and Alerting 

The third layer is provided by the Conflict 
Detection and Alerting (CDA) logic, which is also 
part of the onboard automation. The CDA concept 
was designed to address cases of procedure 
violations or off-nominal conditions. It is based on 
a combination of state vector and procedure-based 
intent information. CDA symbology is displayed 
on the CDTI, which is part of NASA’s 
experimental MFD. 

The CDA was designed to provide conflict 
awareness to aircraft within the SCA during off- 
nominal conditions such as procedure violations 
and emergency operations. The CDA logic is 
based on a hybrid method that uses a combination 
of both ADS-B state vector and intent information 
to predict any loss of separation while minimizing 
false alarms. The method uses the concept of NAP 
conformance as part of the prediction logic. The 
NAP, as described earlier, represents the implicit 
intent of all participating aircraft in the SCA [14]. 

The intent of pilots flying HVO is procedure based 
and therefore known to all participating aircraft in 
the SCA. Pilots are expected to fly the approach 
path, keep appropriate spacing during approach 
and departure operations and maintain their 
intended speed profiles. 

1. Conflict Detection 

The pair-wise conflict detection logic selects different trajectory projections techniques depending on whether 
the aircraft is in conformance or not. An aircraft in conformance is expected to remain in its approach path; 
therefore, its predicted path is projected to be along the approach path. This is referred to as NAP path projection. 
Such assumption cannot be made for an aircraft out of conformance; therefore, its path can only be projected along 
its current state. This is referred to as state based path projection. This hybrid conflict detection scheme was 
developed to reduce false alarms that otherwise frequently occur in terminal areas. False alarms can have an adverse 
effect on pilots in that they may ultimately ignore real conflicts. Preliminary simulation studies [13] have shown that 
this hybrid approach outperforms state based only methods with regards to false and missed alerts. In addition, the 
technique was successfully implemented and used in human in the loop simulations and flight tests with very low 
incidence of false alerts during these tests. 

2. Conflict Alerting 

The conflict alerting algorithm developed for SATS HVO employs a multi-stage, asymmetrical alerting scheme. 
Multistage refers to the use of three levels of alerts, advisories, cautions and warnings; which are based upon the 
time to conflict. Asymmetrical alerting involves selecting the order and time in which pilots are notified of an 
impeding conflict based on a pair-wise inherently simultaneous conflict detection. More details on the conflict 
alerting logic and implementation can be found in [13]. 



Figure 4. Hybrid Conflict Detection Logic 
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• Asymmetrical Alerting 

The alerting system was designed to be configurable so the 
time at which pilots are notified of impending loss of separation 
conflicts can be manipulated for experimental studies. While two 
aircraft running the conflict alerting algorithm can detect a 
conflict simultaneously, the time at which pilots are alerted can be 
delayed depending on certain conditions. In particular, this 
alerting method permits a conflicting aircraft that is out of 
conformance to be notified first so it can make trajectory and 
speed adjustments to correct its course before the conforming 
aircraft is notified. The same logic can be applied to a trailing 
aircraft on approach that, if notified first, can make speed 
adjustments to avert potential conflicts. Resolution advisories to 
potential loss of separation conflicts are not automated in the 
current system and are part of on going research. 

• Multilevel Alerting 

The increasing levels of alerting severity are advisory, caution, 
and warning and are based on the time to conflict. Values for the 
different time to conflict conditions that will trigger the multiple 
alert levels are configurable. All alerts are shown in the traffic 
display on the MFD. The pilot actions for the different alert levels 
are as follows: 

Level 0 Alert: Non-Advisory: Information only. The ownship 
symbol is white and non-advisory traffic is shown as hollow cyan 
chevron symbols. 

Level 1 Alert: Advisory: Pilot Awareness, pilot monitors 
separation and may need to adjust lateral or vertical path and or 
speed according to the situation. Advisory traffic is a cyan filled 
chevron symbol. 

Level 2 Alert: Caution: Pilot Awareness, pilot monitors 

situation and action is likely required to adjust lateral or vertical 
path and or speed according to the situation. Lateral, vertical or a 
combination maneuver may have to be initiated. Advisory traffic 
symbol is an amber hollow chevron with a circle around. 

Level 3 Alert: Warning: Immediate evasive maneuver 

required, vertical, lateral or both. Advisory traffic symbol is a red 
filled chevron with circle around plus an aural alert. 

Alerts will remain on display as long as the conflict exists. 
Alerts are upgraded or downgraded based on the detection 
function output. Figure 5 shows four successive snapshots of a 
traffic conflict caused by an aircraft that deviates from its holding 
pattern, initiating the approach ahead of time. The pilot ignored 
the first PA message “Monitor path” and continued on approach. 
The conflict alert level went from advisory (not shown) to caution 
and warning before the pilot took corrective action and returned to 
its path. The alert level reverted to caution and advisory as the 
likelihood of a conflict was reduced. 


IV. Summary 

SATS HVO includes a unique approach to airborne conflict prevention and separation assurance that assists the 
pilot in a non-towered, non-radar, terminal environment. This method considers the procedural constraints of this 
environment and uses nominal approach path to detennine if the pilot is “in confoimance” with the SATS HVO 
procedures. HVO supports the pilot by a robust system that prevents conflicts by design and procedural support 
advisories, and in the event of procedural violations, provides conflict detection and alerting to cue the pilot to return 
into conformance with the procedure. 



Approach Sequence 
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A multilayer approach to the prevention of conflicts due to the loss of aircraft-to-aircraft separation which relies 
on procedures and on-board automation was implemented as part of the SATS HVO Concept of Operations. The 
multilayer system gives pilots support and guidance during the execution of normal operations and advance warning 
for procedure deviations or off-nominal operations. The major concept elements of this multilayer approach to 
separation assurance and conflict prevention include the HVO procedures themselves; procedures support 
automation, and conflict detection and alerting. All the algorithms and functionality described in this paper have 
been implemented in aircraft simulation experiments in the NASA Langley Research Center’s Air Traffic Operation 
Lab and on the NASA Cirrus SR22 research aircraft for flight test. Results from multiple research activities, 
including human-in-the-loop simulation experiments and flight tests, indicate the conflict prevention function of the 
HVO concept is crucial, especially during off-nominal operations. Further investigations into the effects of varied 
conflict geometries, alerting parameters, and procedural resolutions are ongoing and the subject of future 
publications. 
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